stellarfixer

{"modified":"2026-08-05T15:55:02Z","published":"2026-08-05T15:55:02Z","schema_version":"1.7.4","id":"MAL-2026-13353","summary":"Malicious code in stellarfixer (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bd3a96aa989ed6cadd106e8e7d04317ea30f83434a40eabc307578cb0690b78f)\nOn npm install, the package's postinstall script unconditionally executes a bundled Windows PE at bin/stellarfn.exe via execFileSync. The binary is a.NET remote-access trojan: it opens a socket-based C2 channel (ClientSocket/BeginConnect/ConnectServer, SendMSG, SendBot/ChatID) with plugin loading (WriteAllBytes/ReadAllBytes), installs a low-level keyboard hook (SetWindowsHookEx + WH_KEYBOARD_LL + LowLevelKeyboardProc + ToUnicodeEx) tagged with active-window titles (GetForegroundWindow/GetActiveWindowTitle) for system-wide credential-grade keystroke capture, captures webcam frames (capCreateCaptureWindowA/capGetDriverDescriptionA), propagates to removable drives (USBThread/USBStart/USBSpread/RunDisk), and includes AV-exclusion, SetCurrentProcessIsCritical anti-kill, AES payload encryption, and an uninstaller. Installing this package on a Windows host results in immediate full-host compromise, remote attacker control, credential theft, and worm-like USB propagation.\n","affected":[{"package":{"ecosystem":"npm","name":"stellarfixer"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"3878c7eaaaaf854ab8d44f04bd7c6679d840a3a02ecb295cdbded6d5e779f00c","tlsh":"a0e068d207da9b71a8b1c5c5ee7922b7294fc961730ab890c0ec4d89138319447d3aec"},{"path":"bin/stellarfn.exe","sha256":"ba14d64eb4748850b0496d1db673156772add91215372c96271b03fa1b4d8617","tlsh":"aa233c087bd44610e9feabf51db2a2064732ba079a13d74d0cd5979f1f2b6c0ce417a6"}],"package_integrity":[{"filename":"stellarfixer-1.0.0.tgz","hashes":{"sha1":"9edacaebdae8d12d02bf06d7293a230721eece8e","sha512_sri":"sha512-Q6tEM3WvyHRujsUR9QvoYuYcQfow7meKEgKGKH1AqyTBmulNjK+NyqKQ4FKo6MSh/cjqt2GdeWnS7JpB9bEvYw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/stellarfixer/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015811","import_time":"2026-08-05T16:13:48.524236928Z","modified_time":"2026-08-05T15:55:02Z","sha256":"bd3a96aa989ed6cadd106e8e7d04317ea30f83434a40eabc307578cb0690b78f","source":"amazon-inspector","versions":["1.0.0"]}]}}